4 ms·
It's pretty standard for corporate proxy servers - at least in financial companies where theres regulations that tend to require some level of monitoring of ext
by elemeno 14y ago
It's pretty standard for corporate proxy servers - at least in financial companies where theres regulations that tend to require some level of monitoring of external communications.
It's a simple MITM attack, where the endpoint (your browser) has a whitelisted certificate for the proxy, so the browser is happy that it's talking to a correctly signed certificate that it trusts, and the proxy uses the the certificate for the other end of the connection.
- richardwhiuk 14y agoActually corporate proxy servers generally use CONNECT to allow HTTPS through.
- idlecool 14y agoand what is that?
- carey 14y agoWikipedia describes it briefly at http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunneling http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunnel.... The most recent standard for it appears to be RFC 2817 section 5.2, http://tools.ietf.org/html/rfc2817#section-5.2 http://tools.ietf.org/html/rfc2817#section-5.2, and it’s also in the HTTPbis Semantics and Content drafts, currently at http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-21#section-5.3.6 http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-2....
- idlecool 14y agothats super cool.
- idlecool 14y agoIf they are really doing it, its really bad.
- cwb71 14y agoOne provider of "next-generation" firewalls that do this is Palo Alto Networks: http://www.paloaltonetworks.com/products/features/decryption.html http://www.paloaltonetworks.com/products/features/decryption... It works for SSH too, if you are not careful about host keys and fingerprints.
- potkor 14y agoFortunately that kind of wiretapping is a crime in most of the civilized world, finance sector employer or not.